OAuth 2.0: Protected Resource Metadata

[manusa]

Description

To properly implement OAuth 2.0 workflows, the HTTP server implemented in scope of #135 - #153, must expose a /.well-known/oauth-protected-resource endpoint.

• https://datatracker.ietf.org/doc/rfc9728/
• https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization

[ardaguclu]

We'll continue discussing this. I think, we'll need;

• a new flag that determines the auth-type (none, kubeconfig, oauth, whatever).
• a new flag that is used to specify the issuer-url. This field will be optional. If auth-type is oauth and issuer-url is empty, we can use api server host name as issuer url (retrieved from the kubeconfig)
• new endpoint as described in the description, if auth-type is oauth. This endpoint will serve this metadata.